24-7 Allen Critical Crypto-Ransomware
Computer Virus Identification and Recovery Services

Crypto-Ransomware : Your Crippling Information Technology Disaster
Ransomware has become a modern cyberplague that poses an enterprise-level threat for organizations poorly prepared for an attack. Different iterations of crypto-ransomware such as Reveton, WannaCry, Bad Rabbit, Syskey and MongoLock cryptoworms have been replicating for a long time and still cause destruction. More recent variants of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch or Egregor, as well as additional as yet unnamed viruses, not only do encryption of online data but also infect all available system backup. Information replicated to the cloud can also be encrypted. In a poorly designed environment, this can make any restore operations impossible and basically knocks the entire system back to square one.

Getting back online programs and data after a ransomware outage becomes a sprint against the clock as the victim fights to stop lateral movement, clear the ransomware, and resume business-critical operations. Due to the fact that ransomware takes time to move laterally, penetrations are frequently sprung during nights and weekends, when successful penetrations may take longer to recognize. This compounds the difficulty of quickly assembling and organizing a qualified mitigation team.

Progent makes available a range of help services for protecting organizations from ransomware penetrations. Among these are team training to help identify and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, along with setup and configuration of the latest generation security solutions with AI capabilities from SentinelOne to discover and extinguish zero-day cyber threats quickly. Progent also offers the services of seasoned crypto-ransomware recovery consultants with the skills and commitment to restore a compromised environment as urgently as possible.

Progent's Crypto-Ransomware Recovery Help
Soon after a ransomware invasion, even paying the ransom in cryptocurrency does not provide any assurance that merciless criminals will provide the codes to decrypt any or all of your files. Kaspersky determined that 17% of crypto-ransomware victims never restored their files after having sent off the ransom, resulting in increased losses. The risk is also very costly. Ryuk ransoms are often several hundred thousand dollars. For larger organizations, the ransom demand can reach millions of dollars. The fallback is to setup from scratch the vital components of your Information Technology environment. Absent access to essential data backups, this requires a wide range of skill sets, well-coordinated team management, and the capability to work 24x7 until the recovery project is over.

For two decades, Progent has provided expert Information Technology services for businesses throughout the US and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes consultants who have attained top industry certifications in leading technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security specialists have earned internationally-renowned industry certifications including CISA, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience with financial management and ERP software solutions. This breadth of experience provides Progent the skills to quickly determine critical systems and integrate the surviving parts of your Information Technology environment after a ransomware attack and rebuild them into an operational network.

Progent's ransomware team of experts utilizes top notch project management applications to orchestrate the sophisticated restoration process. Progent understands the importance of acting quickly and in concert with a customer's management and IT team members to prioritize tasks and to put key systems back online as fast as possible.

Business Case Study: A Successful Ransomware Virus Response
A customer contacted Progent after their company was crashed by the Ryuk ransomware. Ryuk is thought to have been developed by Northern Korean state sponsored cybercriminals, possibly using approaches exposed from the United States National Security Agency. Ryuk targets specific companies with little room for disruption and is among the most profitable examples of ransomware viruses. Major organizations include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a single-location manufacturing business headquartered in the Chicago metro area with around 500 workers. The Ryuk penetration had brought down all business operations and manufacturing capabilities. Most of the client's system backups had been on-line at the beginning of the intrusion and were eventually encrypted. The client was taking steps for paying the ransom (in excess of $200K) and wishfully thinking for the best, but in the end engaged Progent.

Progent worked with the client to rapidly get our arms around and assign priority to the most important elements that had to be recovered in order to restart company operations:

• Active Directory
• Email
• Accounting/MRP

In less than two days, Progent was able to restore Windows Active Directory to its pre-virus state. Progent then completed setup and storage recovery of the most important applications. All Exchange schema and attributes were usable, which accelerated the restore of Exchange. Progent was able to collect local OST data files (Microsoft Outlook Off-Line Data Files) on team PCs and laptops in order to recover email messages. A not too old off-line backup of the businesses manufacturing systems made it possible to return these vital applications back available to users. Although major work remained to recover totally from the Ryuk attack, critical services were recovered rapidly:

Over the next month important milestones in the recovery project were achieved through close cooperation between Progent engineers and the customer:

• Self-hosted web applications were returned to operation with no loss of information.
• The MailStore Exchange Server exceeding 4 million archived messages was spun up and available for users.
• CRM/Product Ordering/Invoices/AP/Accounts Receivables/Inventory capabilities were 100 percent recovered.
• A new Palo Alto Networks 850 firewall was installed.
• Nearly all of the user desktops and notebooks were fully operational.

Conclusion
A possible company-ending disaster was averted due to hard-working experts, a wide array of subject matter expertise, and close teamwork. Although upon completion of forensics the ransomware virus incident described here should have been disabled with modern security solutions and recognized best practices, user education, and appropriate security procedures for information backup and keeping systems up to date with security patches, the reality is that government-sponsored cyber criminals from China, Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do fall victim to a ransomware incident, remember that Progent's roster of experts has extensive experience in ransomware virus defense, cleanup, and file restoration.

To review or download a PDF version of this ransomware incident report, please click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent can provide businesses in Allen a portfolio of remote monitoring and security evaluation services to help you to minimize your vulnerability to ransomware. These services incorporate next-generation AI capability to uncover zero-day strains of ransomware that are able to evade legacy signature-based anti-virus solutions.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it possible for small and mid-size businesses to utilize Remote Monitoring and Management (RMM) technology to create leading-edge network resilience. Progent handles the necessary monitoring and management for you, so your network scales smoothly without becoming an obstacle. For an affordable and predictable monthly subscription, Progent's full-service IT group can be your dependable technology safety net. Entry-level plans include remote monitoring and management, security, monthly patching, and documentation. As your needs expand, you can add low-cost subscriptions to best-of-breed options such as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication, penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that incorporates advanced remote monitoring and management (RMM) techniques to keep your IT system running efficiently by checking the state of critical computers that drive your information system. When ProSight LAN Watch uncovers an issue, an alarm is sent immediately to your designated IT staff and your assigned Progent engineering consultant so any looming problems can be resolved before they have a chance to impact productivity. Find out more about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-based platform for managing your network, server, and desktop devices by offering an environment for streamlining common time-consuming jobs. These include health checking, patch management, automated repairs, endpoint configuration, backup and restore, anti-virus protection, secure remote access, built-in and custom scripts, asset inventory, endpoint status reporting, and troubleshooting help. When ProSight LAN Watch with NinjaOne RMM identifies a serious problem, it transmits an alarm to your specified IT staff and your assigned Progent consultant so that potential issues can be fixed before they impact productivity. Learn more about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Network Infrastructure Management
  ProSight WAN Watch is an infrastructure monitoring and management service that makes it simple and affordable for smaller businesses to diagram, track, enhance and debug their networking hardware such as routers and switches, firewalls, and load balancers plus servers, printers, client computers and other devices. Using state-of-the-art Remote Monitoring and Management technology, WAN Watch makes sure that infrastructure topology diagrams are kept updated, captures and manages the configuration information of virtually all devices on your network, monitors performance, and generates alerts when potential issues are discovered. By automating complex network management processes, WAN Watch can knock hours off common tasks like making network diagrams, expanding your network, locating devices that need critical updates, or identifying the cause of performance issues. Find out more about ProSight WAN Watch infrastructure monitoring and management consulting.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing suite of real-time reporting plug-ins created to work with the industry's leading ticketing and network monitoring applications such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to highlight and contextualize critical issues such as spotty support follow-through or endpoints with out-of-date AVs. By identifying ticketing or network health problems concisely and in near-real time, ProSight Reporting improves productivity, lowers management hassle, and saves money. For more information, see ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Backup and Recovery Services
  Progent has worked with leading backup technology providers to create ProSight Data Protection Services, a selection of subscription-based management offerings that provide backup-as-a-service. ProSight DPS services automate and monitor your backup processes and enable transparent backup and fast restoration of vital files/folders, apps, system images, and VMs. ProSight DPS lets your business protect against data loss resulting from equipment failures, natural calamities, fire, malware like ransomware, user error, ill-intentioned insiders, or application bugs. Managed services in the ProSight Data Protection Services portfolio include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda dedicated hardware, and ProSight MSP360 Cloud and On-prem Backup. Your Progent service representative can help you to identify which of these managed backup services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that uses the infrastructure of top information security companies to deliver web-based management and comprehensive protection for all your email traffic. The hybrid architecture of Progent's Email Guard integrates cloud-based filtering with a local security gateway appliance to provide advanced defense against spam, viruses, Dos Attacks, DHAs, and other email-based malware. Email Guard's Cloud Protection Layer acts as a preliminary barricade and blocks most threats from reaching your security perimeter. This decreases your vulnerability to inbound attacks and conserves system bandwidth and storage. Email Guard's on-premises gateway appliance adds a deeper level of analysis for incoming email. For outbound email, the on-premises gateway offers anti-virus and anti-spam protection, protection against data leaks, and email encryption. The local gateway can also help Exchange Server to monitor and safeguard internal email that originates and ends within your security perimeter. For more details, see Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: Access Security, Endpoint Remediation, and Secure Single Sign-on (SSO)
  Progent's Duo MFA service plans incorporate Cisco's Duo cloud technology to protect against password theft through the use of two-factor authentication. Duo enables single-tap identity confirmation on iOS, Android, and other out-of-band devices. Using Duo 2FA, whenever you log into a secured online account and give your password you are requested to verify who you are on a device that only you have and that is accessed using a separate network channel. A wide range of devices can be used as this added means of authentication such as an iPhone or Android or wearable, a hardware/software token, a landline phone, etc. You may register several verification devices. To learn more about ProSight Duo two-factor identity validation services, see Duo MFA two-factor authentication services for access security.

• Progent's Outsourced/Shared Help Center: Call Center Managed Services
  Progent's Support Center managed services enable your IT group to outsource Help Desk services to Progent or divide responsibilities for Help Desk services transparently between your in-house support team and Progent's nationwide roster of certified IT service engineers and subject matter experts. Progent's Co-managed Help Desk Service provides a transparent extension of your in-house network support resources. Client interaction with the Service Desk, provision of technical assistance, issue escalation, ticket generation and tracking, performance metrics, and maintenance of the service database are cohesive whether incidents are taken care of by your in-house network support resources, by Progent, or by a combination. Find out more about Progent's outsourced/co-managed Service Center services.

• Progent Active Protection Against Ransomware: AI-based Ransomware Identification and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection service that utilizes cutting edge behavior-based analysis tools to guard endpoint devices as well as physical and virtual servers against modern malware attacks like ransomware and email phishing, which easily escape traditional signature-based anti-virus products. Progent Active Security Monitoring services safeguard local and cloud resources and provides a unified platform to manage the entire malware attack lifecycle including blocking, identification, mitigation, remediation, and post-attack forensics. Key capabilities include one-click rollback using Windows VSS and real-time network-wide immunization against new threats. Find out more about Progent's ransomware protection and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to capture, update, retrieve and safeguard data about your IT infrastructure, processes, business apps, and services. You can instantly locate passwords or serial numbers and be alerted automatically about upcoming expirations of SSL certificates ,domains or warranties. By updating and organizing your network documentation, you can eliminate up to 50% of time wasted trying to find vital information about your network. ProSight IT Asset Management features a common location for holding and sharing all documents required for managing your business network like standard operating procedures (SOPs) and How-To's. ProSight IT Asset Management also offers a high level of automation for collecting and associating IT information. Whether you're planning improvements, performing regular maintenance, or responding to an emergency, ProSight IT Asset Management gets you the information you need as soon as you need it. Find out more about ProSight IT Asset Management service.

• Patch Management: Software/Firmware Update Management Services
  Progent's managed services for patch management offer businesses of any size a flexible and affordable solution for evaluating, testing, scheduling, implementing, and tracking software and firmware updates to your ever-evolving IT network. Besides maximizing the protection and reliability of your computer network, Progent's software/firmware update management services free up time for your in-house IT team to focus on line-of-business initiatives and activities that deliver the highest business value from your information network. Find out more about Progent's software/firmware update management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small or mid-size organization can have its critical servers and applications hosted in a protected fault tolerant data center on a fast virtual machine host set up and maintained by Progent's IT support experts. With the ProSight Virtual Hosting model, the customer retains ownership of the data, the OS platforms, and the apps. Since the environment is virtualized, it can be ported easily to a different hardware solution without requiring a time-consuming and difficult configuration process. With ProSight Virtual Hosting, your business is not locked into a single hosting provider. Find out more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection service that incorporates SentinelOne's next generation behavior machine learning technology to defend physical and virtual endpoints against new malware assaults such as ransomware and email phishing, which easily get by traditional signature-based anti-virus products. ProSight ASM safeguards on-premises and cloud resources and provides a unified platform to automate the complete malware attack lifecycle including blocking, infiltration detection, containment, remediation, and forensics. Top features include one-click rollback using Windows Volume Shadow Copy Service (VSS) and automatic network-wide immunization against new attacks. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Endpoint Security and Microsoft Exchange Email Filtering
  ProSight Enhanced Security Protection (ESP) managed services offer ultra-affordable multi-layer protection for physical servers and virtual machines, workstations, smartphones, and Exchange email. ProSight ESP utilizes adaptive security and advanced heuristics for round-the-clock monitoring and responding to cyber assaults from all vectors. ProSight ESP delivers firewall protection, penetration alarms, device control, and web filtering through leading-edge technologies incorporated within one agent managed from a unified console. Progent's data protection and virtualization experts can assist you to design and configure a ProSight ESP environment that meets your company's unique needs and that helps you demonstrate compliance with legal and industry data security regulations. Progent will assist you define and implement security policies that ProSight ESP will enforce, and Progent will monitor your network and react to alerts that require urgent attention. Progent's consultants can also assist your company to set up and verify a backup and restore solution such as ProSight Data Protection Services so you can get back in business quickly from a potentially disastrous security attack such as ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified endpoint security and Exchange email filtering.